CVE-2026-17940: Chrome Android PiP RCE Vulnerability

CVE-2026-17940 Overview

CVE-2026-17940 affects Google Chrome on Android versions prior to 151.0.7922.72. The vulnerability stems from insufficient validation of untrusted input in the Picture-in-Picture (PiP) component. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially perform a sandbox escape. Chromium security classifies this issue as Low severity. The flaw is categorized under CWE-20: Improper Input Validation and requires prior renderer compromise as a precondition for exploitation.

Critical Impact
An attacker with a compromised renderer process can escape the Chrome sandbox on Android devices, breaking a core browser isolation boundary.

Affected Products

Google Chrome on Android prior to version 151.0.7922.72
Chromium-based components using the vulnerable Picture-in-Picture implementation
Android devices running affected Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17940 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17940

Vulnerability Analysis

The vulnerability resides in the Picture-in-Picture feature of Google Chrome on Android. The PiP component does not sufficiently validate untrusted input received from the renderer process. An attacker who has already achieved code execution inside the renderer can send crafted messages or data structures to the more privileged browser process through the PiP interface.

The sandbox model in Chromium relies on strict validation of every message crossing the renderer-to-browser trust boundary. When validation is incomplete, a compromised renderer can drive the higher-privileged process into an unintended state, enabling a sandbox escape. This weakness is classified as [CWE-20: Improper Input Validation].

Root Cause

The root cause is missing or incomplete validation of untrusted input handled by the Picture-in-Picture code path. Data originating in the renderer is trusted further than intended when it reaches the browser process. See the Chromium Issue Tracker Entry for additional technical context.

Attack Vector

Exploitation requires two stages. First, the attacker must compromise the renderer process, typically through a separate vulnerability triggered by a malicious web page. Second, the attacker uses the compromised renderer to deliver crafted input to the Picture-in-Picture interface. Successful exploitation results in a sandbox escape, granting the attacker capabilities outside the renderer sandbox on the Android device.

No verified exploit code is publicly available. Refer to the Google Chrome Update Announcement for vendor guidance.

Detection Methods for CVE-2026-17940

Indicators of Compromise

Chrome for Android instances reporting versions earlier than 151.0.7922.72 on managed devices
Unexpected Chrome browser process crashes or restarts correlated with Picture-in-Picture activity
Anomalous child process behavior originating from Chrome on Android endpoints

Detection Strategies

Inventory Chrome for Android versions across the mobile fleet and flag installations below 151.0.7922.72
Monitor Android mobile device management (MDM) telemetry for Chrome version compliance drift
Correlate browser process anomalies with visits to untrusted or newly registered domains

Monitoring Recommendations

Ingest Android application inventory data into a centralized data lake for version tracking
Alert on Chrome crash reports that reference Picture-in-Picture modules on Android
Track outbound network activity from mobile endpoints to detect post-exploitation staging

How to Mitigate CVE-2026-17940

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce automatic Chrome updates on managed Android devices via MDM policy
Restrict access to untrusted web content on high-risk mobile endpoints until patching is confirmed

Patch Information

Google released Chrome 151.0.7922.72 for Android to remediate this vulnerability. Details are available in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry. Apply the update as soon as it becomes available in the distribution channel.

Workarounds

Disable Picture-in-Picture usage on managed Android profiles until patches are deployed
Limit browsing to trusted sites on unpatched devices to reduce the risk of renderer compromise
Use MDM policies to enforce Chrome version minimums and block downgrade

bash

# Verify Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 151.0.7922.72 or later